When an App Service Certificate is renewed, all the corresponding App Service SSL bindings are updated automatically, this may lead to dangling certificates in Azure App Service Certificate Order.
In Azure Console -
In Terraform -
References:
https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex%2Cportal
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#site_config